Bug 975378 - SELinux is preventing /usr/sbin/libvirtd from connectto access on the unix_stream_socket /run/libvirt/virtlockd-sock.
SELinux is preventing /usr/sbin/libvirtd from connectto access on the unix_st...
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.0
All Linux
medium Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
Milos Malik
:
Depends On: 968128 973543
Blocks:
  Show dependency treegraph
 
Reported: 2013-06-18 06:16 EDT by Ján Tomko
Modified: 2014-06-17 22:22 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-06-13 08:52:15 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Ján Tomko 2013-06-18 06:16:48 EDT
Description of problem:
SELinux is preventing /usr/sbin/libvirtd from connectto access on the unix_stream_socket /run/libvirt/virtlockd-sock.

Version-Release number of selected component (if applicable):
Source RPM Packages           libvirt-daemon-1.0.5-2.el7.x86_64
Policy RPM                    selinux-policy-3.12.1-49.el7.noarch

How reproducible:
Always.

Steps to Reproduce:
1. There was no libvirt release with bug 973543 and bug 968128 fixed yet.

For libvirt 1.0.5 work around bug 968128 by adjusting the socket path manually:
In /usr/lib/systemd/system/virtlockd.socket set:
ListenStream=/var/run/libvirt/virtlockd-sock

Bug 973543 in 1.0.6 cannot be worked around, but both should be fixed in the next release.

2. Change the lock manager to lockd in /etc/libvirt/qemu.conf:
lock_manager = "lockd"

3. Request automatic disk leases in /etc/libvirt/qemu-lockd.conf:
auto_disk_leases = 1

4. Restart virtlockd and libvirtd services.

5. Try to start a domain with a disk:

qemu-img create -f qcow2 /var/lib/libvirt/images/cake.qcow2 10M

virsh create /dev/stdin <<EOF
<domain type='qemu'>
  <name>cake</name>
  <memory unit='MiB'>32</memory>
  <os>
    <type arch='x86_64' machine='pc'>hvm</type>
  </os>
  <devices>
    <emulator>/usr/libexec/qemu-kvm</emulator>
    <disk type='file' device='disk'>
      <driver name='qemu' type='qcow2'/>
      <source file='/var/lib/libvirt/images/cake.qcow2'/>
      <target dev='vda' bus='virtio'/>
    </disk>
  </devices>
</domain>
EOF

Actual results:
Domain fails to start:
error: Failed to create domain from /dev/stdin
error: Child quit during startup handshake: Input/output error

 and this error appears in /var/log/messages:
Jun 18 05:59:24 456rhel setroubleshoot: SELinux is preventing /usr/sbin/libvirtd from connectto access on the unix_stream_socket /run/libvirt/virtlockd-sock. For complete SELinux messages. run sealert -l 3568d43a-05a4-4b07-a805-c57c4e572b10

Expected results:
Domain starts.

Additional info:
SELinux is preventing /usr/sbin/libvirtd from connectto access on the unix_stream_socket /run/libvirt/virtlockd-sock.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that libvirtd should be allowed connectto access on the virtlockd-sock unix_stream_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep libvirtd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Additional Information:
Source Context                system_u:system_r:svirt_tcg_t:s0:c533,c698
Target Context                system_u:system_r:initrc_t:s0
Target Objects                /run/libvirt/virtlockd-sock [ unix_stream_socket ]
Source                        libvirtd
Source Path                   /usr/sbin/libvirtd
Port                          <Unknown>
Host                          456rhel
Source RPM Packages           libvirt-daemon-1.0.5-2.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-49.el7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     456rhel
Platform                      Linux 456rhel 3.10.0-0.rc4.60.el7.x86_64 #1 SMP
                              Thu Jun 6 12:27:28 EDT 2013 x86_64 x86_64
Alert Count                   1
First Seen                    2013-06-18 05:59:22 EDT
Last Seen                     2013-06-18 05:59:22 EDT
Local ID                      3568d43a-05a4-4b07-a805-c57c4e572b10

Raw Audit Messages
type=AVC msg=audit(1371549562.105:202): avc:  denied  { connectto } for  pid=1117 comm="libvirtd" path="/run/libvirt/virtlockd-sock" scontext=system_u:system_r:svirt_tcg_t:s0:c533,c698 tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket


type=SYSCALL msg=audit(1371549562.105:202): arch=x86_64 syscall=connect success=no exit=EACCES a0=3 a1=7f66606b4e20 a2=6e a3=6b636f732d646b items=0 ppid=1 pid=1117 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=libvirtd exe=/usr/sbin/libvirtd subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)

Hash: libvirtd,svirt_tcg_t,initrc_t,unix_stream_socket,connectto
Comment 3 Milos Malik 2013-06-19 03:35:58 EDT
Unfortunately, virtlockd runs as initrc_t.

# ls -Z `which virtlockd `
-rwxr-xr-x. root root system_u:object_r:bin_t:SystemLow /usr/sbin/virtlockd
# matchpathcon `which virtlockd`
/usr/sbin/virtlockd	system_u:object_r:bin_t:SystemLow
#
Comment 7 Ludek Smid 2014-06-13 08:52:15 EDT
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.